PT-2024-34466 · Unknown · Simplcommerce

Abdullah Almutawa · Published 2024-12-20 · Updated 2025-01-05 · CVE-2024-50945

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: SimplCommerce version 230310c8d7a0408569b292c5a805c459d47a1d8f

Description: An improper access control issue exists, allowing users to submit reviews without verifying if they have purchased the product. This issue affects the review system, enabling unauthorized users to post reviews for products they have not purchased.

Recommendations: As a temporary workaround, consider disabling the review submission feature until a patch is available. Restrict access to the review system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-284

Related Identifiers

CVE-2024-50945

Affected Products

Simplcommerce

References · 14

• 🔥 https://github.com/AbdullahAlmutawa/CVE-2024-50945 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-50945 · Security Note
• https://osv.dev/vulnerability/CVE-2024-50945 · Vendor Advisory
• https://github.com/simplcommerce/SimplCommerce · Note
• https://twitter.com/CVEnew/status/1872889669450658024 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1869913867196739979 · Twitter Post
• https://twitter.com/_D3CAFF/status/1875243751477539066 · Twitter Post
• https://twitter.com/byt3n33dl3/status/1875716294949110067 · Twitter Post
• https://twitter.com/_D3CAFF/status/1875243908659294415 · Twitter Post
• https://twitter.com/cracbot/status/1874334816751280278 · Twitter Post
• https://t.me/cvedetector/13793 · Telegram Post
• https://twitter.com/_D3CAFF/status/1875243042984394863 · Twitter Post
• https://simplcommerce.com · Note
• https://t.me/cvenotify/105684 · Telegram Post